IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Expand all | Collapse all

When using AQL, is it possible to specify any user in the AQL syntax

  • 1.  When using AQL, is it possible to specify any user in the AQL syntax

    Posted Fri December 08, 2023 04:13 AM

    Greetings,

    Kindly I need to know if it is possible to have an AQL advanced search where we can specify ANY username ( for example username = ANY)

    I know that we can remove the username filter to get all usernames, but I have a PULSE case where we need to specify ANY username to list the event.

    I have a pulse dashboard where I need to list all the events (Username parameter is ANY) and when I click on one specific event, the same dashboard will be updated based on the username (username parameter = user1)

    At the moment I did a workaround using "ilike" statement and it is working as expected, but I am trying to find a solution using "=" so the search will be much faster

    The workaround is to use the following syntax "username ilike '{user (% for any)}' "  in my AQL search.

    The default user parameter is "%"  so the default search filter will be  "username ilike '%' " so, in this case, all events are fetched.

    When I click on any username the filter will be "username ilike 'user1'" and only events with user1 as username will be fetched.

    I am looking for a solution using = and not ilike

    Do you think it is possible?

    Best Regards



    ------------------------------
    Nabil Nehme
    ------------------------------


  • 2.  RE: When using AQL, is it possible to specify any user in the AQL syntax

    Posted Fri December 08, 2023 09:42 AM

    In Access Query Language (AQL), you typically query a database to retrieve information. However, specifying "any user" in the AQL syntax is not a standard feature. AQL is generally concerned with querying data based on certain criteria, and it doesn't inherently have a way to target "any user."

    If you want to query data related to a specific user, you would usually need to provide a condition or criteria in your AQL query to filter the results based on the user you're interested in. 
    If your question is about some specific use case or system that uses AQL, it's recommended to refer to the documentation or guidelines provided by that system to understand how users are handled in queries.



    ------------------------------
    soniya sharma
    ------------------------------